CVE-2022-33965
Published: 25 July 2022
Summary
CVE-2022-33965 is a critical-severity SQL Injection (CWE-89) vulnerability in Codepress Visitor Statistics. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2022-33965 comprises multiple unauthenticated SQL injection flaws, tracked under CWE-89, that affect the WP Visitor Statistics plugin (also known as wp-stats-manager) for WordPress in versions up to and including 5.7. The issues carry a CVSS 3.1 score of 9.3 with a network attack vector, low complexity, and no required privileges or user interaction, while producing a changed scope that can yield high confidentiality impact alongside limited integrity impact.
An unauthenticated remote attacker can supply crafted input to the plugin's statistics-handling routines to execute arbitrary SQL commands against the WordPress database, enabling extraction of sensitive data or limited modification of stored records without any prior access.
Public advisories published by Patchstack and referenced on the WordPress plugin directory identify the vulnerable releases and direct administrators to obtain corrected versions from the plugin developers once available. The associated EPSS score has remained at 0.4278 from disclosure onward, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37001
Vulnerability details
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.